Tracking: the open backlog

[al8n]

Umbrella for the whole open backlog. Every item below has its own issue with the mechanism, the evidence, file references, and — where it was deliberately deferred — the reason.

How this list was produced, and what it is not

These are not regressions from recent work. They are the accumulated output of sustained adversarial review pointed at code that had never been measured. Of the items filed most recently, all but one were already true of main before the work that found them; they were simply not written down.

The one exception is noted in its own issue as a deliberate consequence, not a defect.

Review-round counts are falling as the review finds less: 17 rounds to clean approve, then 14, then 3.

---

P0 — release blockers

Nothing else blocks publishing.

• Version reconciliation: the manifests are already ahead of crates.io #94 — version reconciliation: manifests are already ahead of crates.io, and hick-trace now needs its first breaking bump
• Nothing verifies CHANGELOG.md — it asserted a release that never happened, and drifted mid-branch #96 — nothing verifies CHANGELOG.md; it asserts a release that never happened and drifted mid-branch
• Release coordination: prerequisites, and the unposted reply to #86 #95 — release coordination, publish order (hick-onlink first), and the unposted reply to "dropping off-link packet" for link-local packets #86

P1 — correctness or safety on shipped code

• Two RFC 6762 §11 group-admission holes grant the source exemption without link proof #97 — two RFC 6762 §11 group-admission holes grant the source exemption without link proof
• With instance == host, the instance NSEC denies A/AAAA records the same announcement emits #98 — with instance == host, the instance NSEC denies A/AAAA records the same announcement emits
• The conflict rename loop has no RFC 6762 §8.1 fifteen-in-ten-seconds backoff #99 — the conflict rename loop has no §8.1 fifteen-in-ten-seconds backoff (an amplification vector)
• A value documented as "must never drive an admission decision" is what mdns-proto takes as interface_index #100 — a value documented as "must never drive an admission decision" is what mdns-proto takes as interface_index
• Cache keys on Name's derived equality, so a caller-supplied name without the root dot misses every entry #101 — Cache keys on derived equality, so a caller-supplied name without the root dot misses every entry
• Family provenance is collapsed to an aggregate at three separate layers — one still open #102 — family provenance collapsed to an aggregate at three layers; one still open
• hick-compio and hick-reactor read an enumeration error as "this interface has no IPv6" #103 — hick-compio/hick-reactor read an enumeration error as "no IPv6"
• hick-udp/src/onlink.rs reads an enumeration failure as absence at two sites, one feeding the §11 gate #104 — onlink.rs reads an enumeration failure as absence, one site feeding the §11 gate
• The socket drivers keep diverging, and every divergence has been found by review rather than by a test #105 — the drivers keep diverging, and every divergence was found by review rather than by a test
• Add a Windows CI test leg — the Windows path has never been executed, only compiled and linted #106 — add a Windows CI test leg; that path has never been executed, only compiled and linted

P2 — real defects, bounded impact or unlikely trigger

• The §11 mutation-probe set exists only in session logs; record it in-repo #107 — the §11 mutation-probe set exists only in session logs
• Port the §8.2.1 tiebreak probes into mdns-proto/probes/ — they live only on scratch storage #108 — the §8.2.1 tiebreak probes live only on scratch storage
• Four near-verbatim copies of the test corroborated-skip policy, kept in sync by nothing #109 — four near-verbatim copies of the test skip policy, kept in sync by nothing
• FreeBSD clippy is unchecked, and three lint failures are already latent on main #110 — FreeBSD clippy is unchecked, and three lint failures are already latent on main
• An empty address snapshot admits subnet-directed broadcast as protocol input #111 — an empty address snapshot admits subnet-directed broadcast as protocol input
• The router re-walks from the top on every next() — quadratic in questions, and again in services #112 — the router re-walks from the top on every next() — quadratic twice over
• A failed SO_TIMESTAMP enable silently degrades every self-send claim for the socket's life #113 — a failed SO_TIMESTAMP enable silently degrades every self-send claim for the socket's life
• cargo fmt cannot see mdns-proto/src/endpoint/** because its mod declaration is inside a macro #114 — cargo fmt cannot see mdns-proto/src/endpoint/**; the check passes because it never ran
• No host --all-targets build at default features, and miri's conclusion reads as null in check-runs #115 — no host --all-targets build at default features, and miri's conclusion reads as null
• rustdoc fails under -D warnings in two configurations CI never builds #116 — rustdoc fails under -D warnings in two configurations CI never builds
• Confirmed sibling publication leaves an already-sent goodbye credit stale #117 — confirmed sibling publication leaves an already-sent goodbye credit stale
• mdns-proto's Name cannot represent an instance label containing a dot, which RFC 6763 §4.1.1 permits #118 — Name cannot represent an instance label containing a dot, which RFC 6763 §4.1.1 permits
• §6.1: the negative answer is dropped whenever known answers suppress every positive record #144 — §6.1: the negative answer is dropped whenever known answers suppress every positive record
• §6.1: the NSEC bitmap omits PTR records that can exist at an instance name #145 — §6.1: the NSEC bitmap omits PTR records that can exist at an instance name
• §6.1/§10.1: an emitted NSEC is never withdrawn, so a stale one can deny a later owner #146 — §6.1/§10.1: an emitted NSEC is never withdrawn, so a stale one can deny a later owner
• §6.1: registration compares names within a role, so a sibling can publish at our instance name #147 — §6.1: registration compares names within a role, so a sibling can publish at our instance name

P3 — hygiene, ergonomics, long tail

• Route compio-Windows through hick-udp's WSARecvMsg #119 — route compio-Windows through hick-udp's WSARecvMsg
• hick-udp docs describe hick-onlink behaviour with nothing checking the two agree #120 — hick-udp docs describe hick-onlink behaviour with nothing checking the two agree
• adjudicate overloads WeHold: a non-verdict and a won comparison are the same value #121 — adjudicate overloads WeHold: a non-verdict and a won comparison are the same value
• hick-smoltcp does not log goodbye sends, unlike the three std drivers #122 — hick-smoltcp does not log goodbye sends, unlike the three std drivers
• Known-answer suppression classifies by name on ingest and by rtype on emit #123 — known-answer suppression classifies by name on ingest and by rtype on emit
• WithdrawalSnapshot::owned carries a likely-stale #[allow(dead_code)] #124 — WithdrawalSnapshot::owned carries a likely-stale #[allow(dead_code)]
• Two consequences of the honest interface-lookup error classification #125 — two recorded decisions from the interface-lookup work
• try_register_service still accepts a structurally invalid service_type #126 — try_register_service still accepts a structurally invalid service type

Design-first, not a release blocker

• Host-name ownership per RFC 6762 §9 — the host cell has no recoverable consequence to spend a conflict label on #92 — host-name ownership per RFC 6762 §9. Measured rather than assumed: ServiceUpdate, ServiceEvent and EndpointEvent are all #[non_exhaustive], so new states are additive and this does not have to precede the release.

---

Three classes account for most of this list

Fixing them by class closes several issues each; fixing them one instance at a time is what makes the list look endless.

1. Absence read as fact. An error, an empty result, or a check that never ran is treated as a negative claim.
#103, #104, #111, #114, #115, #116 — and, historically, an unparseable workflow file that contributed no checks while reading as green.

hick-mio's has_addr_in already states the rule: "a failure is not an absence… has cost this crate twice before." The InterfaceLookup classifier now in hick-udp/src/multicast.rs is the shape to reuse — #103 and #104 are one PR, not two.

2. One fact, two spellings, no single home. The same truth stated in two places and kept in sync by care rather than by a compiler.
#98, #102, #109, #120, #123.

Every instance has cost review rounds. The precedent that works is extraction: the §11 rule copied into four drivers became one no_std crate, with the copies deleted rather than synchronised.

3. Found by reading, never by a test. Five driver divergences, and every per-family collapse.
#105 is the structural answer — a conformance harness driving all four drivers with identical inputs, asserting their decisions agree or that each disagreement is deliberate.

[al8n]

Also tracked here for completeness: #86 (the reported bug — root-caused and fixed on main, awaiting release; see #95 for the unposted reply) and #36 (the pre-existing rustix migration tracker, unrelated to this backlog).